Security Monitoring & Detection Engineering Lead

Overview

In this senior, hands-on role you lead the security monitoring and detection engineering for AJ Bell, owning the SIEM and threat-detection roadmap. You translate priorities into concrete monitoring, detection and response capabilities, working with Cyber Defence Operations, Technology and MSSP to reduce risk. You will drive threat-informed defense, lead investigations and build scalable, automated defense capabilities with measurable security outcomes. This is an opportunity to shape how we protect customers, data and services at scale.

Pay / Benefits

• 27 days holiday
• 8% pension with matched contributions
• Discretionary bonus scheme
• Share schemes (including free shares and BAYE)
• Private healthcare and dental plan
• Healthcare cash plan

Responsibilities

• Set and own the direction for security monitoring and detection engineering, translating priorities into a clear roadmap
• Lead architecture and development of the SIEM, ensuring resilience, scalability and cost-effectiveness
• Oversee telemetry onboarding across on-premises, Azure, AWS and third-party services to close visibility gaps
• Manage the detection engineering lifecycle (requirements, design, testing, deployment, tuning, retirement) with governance
• Lead analytics rule development, hunting queries, workbooks and automated investigation workflows
• Ensure operational effectiveness of security solutions with measurable outcomes
• Drive threat-informed defense using threat intelligence and exposure management to translate into detections and automated actions
• Identify and implement automation/AI applications to improve quality, speed and coverage of detection and response
• Lead complex investigations and incidents, acting as senior technical escalation point and coordinating responses with MSSP and internal teams
• Develop playbooks, run tabletop and purple-team exercises to test coverage and readiness
• Maintain KPI/MI for service performance, alerts, MTTA/MTTR and incident readiness; drive improvements
• Lead vendor/service reviews to maximise value from security investments
• Foster an integrated monitoring and response capability across internal teams and MSSP
• Mentor and develop Senior Analysts and junior team members
• Participate in on-call rotation for significant out-of-hours events

Key requirements

• Extensive experience in security monitoring, SIEM engineering, detection engineering and incident response in a complex enterprise
• Strong track record with Microsoft Sentinel as production security monitoring/response
• Deep expertise in KQL and analytics rule development, hunting queries, dashboards and threat content
• Experience designing telemetry architectures and onboarding security data (parsing, normalization, retention, data quality, cost)
• Experience integrating cloud telemetry (AWS, Azure) into central monitoring and leading investigations across cloud environments
• Knowledge of Microsoft Defender XDR across endpoints, identities, email and cloud security; evidence correlation
• Experience creating automated investigation/response workflows using Azure Logic Apps, APIs, PowerShell, Python or similar
• Experience governing a production detection engineering lifecycle with version control and controlled deployment
• Experience operating security platforms like Mimecast, Varonis or similar
• Ability translating adversary behaviour and threat intel into improved detection/response
• Strong written and verbal communication translating threats into business implications
• Preferred: experience leading red-team/purple-team/offensive security activities
• Experience in financial services or regulated environments
• Relevant certifications or training (e.g., GCIH, GCIA, CRTO, OSCP, CEH)
• On-call experience and ability to coordinate across internal teams and MSSP

• Strong communication and stakeholder management
• Clear technical leadership and mentoring
• Judgement and risk-based decision making
• Microsoft Sentinel
• KQL
• Analytics rules, hunting queries, workbooks

…